So does this work with a proper sanitizer? Doesn't look like it.
If you have a broken sanitizer, or worse youre inserting it without sanitizing it, you're already vulnerable to XSS... this is just a lot of writing showing an exploit caused by a broken sanitizer.
If you have a sanitizer that cleans up ' and ", that'd only serve to limit the vulnerability to executing javascript without quotations in it. That's nowhere near a comfortable place to be - user data should not end up interpreted as Javascript, quotations or not.
If the result was too verbose, you can always handroll your own JS:
{{constructor.constructor(constructor.name.constructor.fromCharCode(97,108,101,114,116,40,39,120,115,115,39,41))()}}Arguably, that's not a problem, because '{' and '}' aren't HTML special characters, so the function is working exactly as intended.